dev-browser
Verdict safe, but 7 findings (4 medium, 3 low), mainly data exfiltration, policy violation, transitive trust abuse. Most recent scan 2026-02-08.
The dev-browser skill presents MEDIUM security risks primarily related to unrestricted network access and authenticated session control. The skill provides legitimate browser automation functionality but lacks security guardrails around URL navigation, authenticated session access, and resource limits. The most significant concerns are: (1) Extension Mode's access to authenticated browser sessions without additional safeguards, (2) unrestricted navigation to arbitrary URLs that could be exploited for data exfiltration or phishing, and (3) missing allowed-tools declaration that would improve transparency. The skill does not contain malicious code, prompt injection attempts, or hardcoded credentials. The referenced files are internal to the skill package (normal behavior) except for missing files that don't pose security risks. With proper security warnings, URL validation, and user confirmation workflows, this skill could be used safely for legitimate browser automation tasks.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
The two scanners disagree: Cisco found nothing and SkillSpector says do not install. One of them has a blind spot here; read the skill before trusting either. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Browser automation with persistent page state. Use when users ask to navigate websites, fill forms, take screenshots, extract web data, test web apps, or automate browser workflows. Trigger phrases include "go to [url]", "click on", "fill out the form", "take a screenshot", "scrape", "automate", "test the website", "log into", or any browser interaction request.
- Package
- 18 files, 249 KB
- SKILL.md
- 900 words, 12+ sections
- Code
- TypeScript (11), Shell (1)
SKILL.md covers: Dev Browser Skill · Choosing Your Approach · Setup · Standalone Mode (Default) · Extension Mode · Writing Scripts · Key Principles · Workflow Loop · No TypeScript in Browser Context · Scraping Data · Client API · Waiting
Findings
MEDIUM TRANSITIVE TRUST ABUSE detected by YARA Transitive Trust Abusestatic
Detects skills that delegate trust to untrusted external content: Execute scripts
SKILL.md:52
Execute scripts inline using heredocs:MEDIUM Missing allowed-tools Declaration Unauthorized Tool Usellm
The skill does not declare 'allowed-tools' in its YAML manifest. While this field is optional per the agent skills specification, its absence means there are no explicit restrictions on which agent tools can be used. Given that this skill involves browser automation with network access, file system operations, and script execution, declaring allowed-tools would improve transparency and security posture.
SKILL.md
YAML manifest shows: allowed-tools: Not specifiedMEDIUM Unrestricted Network Access via Browser Automation Data Exfiltrationllm
The skill provides unrestricted browser automation capabilities that can navigate to any URL, including potentially malicious sites. The instructions explicitly mention 'go to [url]' as a trigger phrase, and scripts can call page.goto() with arbitrary URLs. This creates risk of: (1) navigating to phishing/malware sites, (2) exfiltrating data by navigating to attacker-controlled domains, (3) credential theft if the browser has saved passwords, (4) session hijacking in Extension Mode where the user's authenticated browser is controlled.
SKILL.md
Instructions state: 'Use when users ask to navigate websites, fill forms, take screenshots, extract web data, test web apps, or automate browser workflows. Trigger phrases include "go to [url]"'. Scripts show: 'await page.goto("https://example.com")' with no URL validation or allowlisting.MEDIUM Extension Mode Enables Access to Authenticated Sessions Data Exfiltrationllm
Extension Mode connects to the user's existing Chrome browser with active login sessions. The instructions explicitly state 'Use this when: The user is already logged into sites and wants you to do things behind an authed experience'. This creates significant data exposure risks: (1) the agent can access any authenticated site the user is logged into, (2) credentials and session tokens are accessible, (3) actions can be performed on behalf of the user without additional authentication, (4) sensitive data from authenticated sessions can be extracted.
SKILL.md
Instructions state: 'Connects to user's existing Chrome browser. Use this when: The user is already logged into sites and wants you to do things behind an authed experience that isn't local dev.' and 'Automation runs on the user's actual browser session'LOW Skill does not specify a license Policy Violationstatic
Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.
SKILL.md
LOW Missing License and Compatibility Metadata Data Exfiltrationllm
The skill does not specify a license or compatibility information in its YAML manifest. While not a direct security threat, missing license information creates legal uncertainty, and missing compatibility information prevents users from understanding platform requirements and limitations.
SKILL.md
YAML manifest shows: license: Not specified, compatibility: Not specifiedLOW Potential for Unbounded Script Execution Resource Abusellm
The skill allows execution of arbitrary TypeScript code via heredocs with no apparent timeout or resource limits. The instructions mention 'page.waitForTimeout(3000)' and network request interception that could run indefinitely if pages don't load or APIs don't respond. While not explicitly malicious, this creates potential for resource exhaustion or hanging processes.
SKILL.md
Instructions show: 'npx tsx <<'EOF' ... await page.waitForTimeout(3000); ... EOF' with no timeout limits. Scraping guide shows pagination loops with no bounds checking.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 6.7 KB |
bun.lock | config | 46 KB |
package-lock.json | config | 97 KB |
package.json | config | 719 B |
server.sh | script | 521 B |
tsconfig.json | config | 844 B |
vitest.config.ts | script | 283 B |
references/scraping.md | doc | 5.2 KB |
scripts/start-relay.ts | script | 677 B |
scripts/start-server.ts | script | 3.6 KB |
src/client.ts | script | 14 KB |
src/index.ts | script | 8.1 KB |
src/relay.ts | script | 21 KB |
src/types.ts | script | 726 B |
src/snapshot/browser-script.ts | script | 37 KB |
src/snapshot/index.ts | script | 562 B |
src/snapshot/inject.ts | script | 578 B |
src/snapshot/__tests__/snapshot.test.ts | script | 5.6 KB |
External hosts referenced
registry.npmjs.org github.com opencollective.com feross.org tidelift.com www.patreon.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
HOST PORT USERPROFILE
Package contents recorded 2026-10-22 at commit 66682fb0513a. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/SawyerHood/dev-browser
- Raw scan result: skills-dev-browser-scan.json
- Badge for your README:
- Request a re-scan